# CVE-2025-53066: Oracle Java SE and GraalVM Information Exposure in JAXP

Source: https://junglewise.ai/threats/cve-2025-53066-oracle-java-se-and-graalvm-information-exposure-in-jaxp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-21. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2025-53066 · Severity: high · CVSS 7.5 · Published 2025-10-21

A vulnerability exists in the Java XML processing component (JAXP) used by Oracle Java and GraalVM to handle structured data. An unauthenticated attacker could exploit this over a network to gain unauthorized access to sensitive information or all data accessible by the Java application. This is particularly critical for web services that process XML data or client-side applications running untrusted code in a sandbox.

Technologies: [Oracle GraalVM Enterprise Edition](https://junglewise.ai/threats/technologies/graalvm-enterprise-edition), [Oracle Graalvm For Jdk](https://junglewise.ai/threats/technologies/graalvm-for-jdk), [Oracle Java SE](https://junglewise.ai/threats/technologies/java-se). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2025-53066 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-53066 being exploited in the wild.

**How severe is CVE-2025-53066?** High severity, with a CVSS score of 7.5, published 21 October 2025.

**Which products and versions are affected?** Debian OpenJDK 11 before 11.0.29+6-1~deb11u1; Oracle GraalVM Enterprise Edition 21.3.15; Oracle Graalvm For Jdk 17.0.16, 21.0.8; Oracle Java SE 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25.

**Is there a fix for CVE-2025-53066?** A patch was published on 2025-10-25: Debian released openjdk-11 security update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-53066 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-53066?** Check whether you run Debian OpenJDK 11, Oracle GraalVM Enterprise Edition, Oracle Graalvm For Jdk or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is located in the Java API for XML Processing (JAXP) component of Oracle Java SE and GraalVM. It is classified as an Information Exposure (CWE-200) and, according to Debian advisories, may specifically relate to XML External Entity (XXE) injection or incorrect certificate validation. The flaw is easily exploitable by an unauthenticated attacker with network access via multiple protocols, typically by providing malicious XML data to a web service or application that utilizes the affected JAXP APIs. Successful exploitation allows for unauthorized access to critical data, bypassing intended confidentiality controls. Oracle addressed this in the October 2025 Critical Patch Update, and OpenJDK updates (e.g., 11.0.29+6) are available.

## Affected products

- Oracle Java SE 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25
- Oracle GraalVM for JDK 17.0.16, 21.0.8
- Oracle GraalVM Enterprise Edition 21.3.15
- Debian openjdk-11 before 11.0.29+6-1~deb11u1

## Timeline

- 2025-10-21: advisory: Initial Oracle advisory published
- 2025-10-21: disclosed
- 2025-10-25: patched: Debian released openjdk-11 security update

## References

- [https://www.oracle.com/security-alerts/cpuoct2025.html](https://www.oracle.com/security-alerts/cpuoct2025.html)
- [https://lists.debian.org/debian-lts-announce/2025/10/msg00026.html](https://lists.debian.org/debian-lts-announce/2025/10/msg00026.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)

## Related threats

- [Oracle Java SE JSSE protocol handling vulnerability](https://junglewise.ai/threats/cve-2026-114820-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk)
- [Oracle Java SE JSSE remote data exposure and modification](https://junglewise.ai/threats/cve-2026-91403-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)
- [Oracle Java SE compiler vulnerability in data access](https://junglewise.ai/threats/cve-2026-91487-vulnerability-in-oracle-java-se-component-compiler-supported)
- [Oracle Java SE Java plugin sandbox escape](https://junglewise.ai/threats/cve-2026-91484-vulnerability-in-oracle-java-se-component-java-plugin-supported)
- [Oracle Java SE JGSS information disclosure](https://junglewise.ai/threats/cve-2026-91464-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)